20 kinds of test cases a public page already tells you about
Before anyone writes a single automated test, a public page has already told you a lot: what it answers over https, which links it exposes, whether its fields have labels, which headers it sends, how long the document takes to arrive. Most first test plans stop at "the happy path works". Here is the list I use instead when I read a page for the first time. Each kind has one example case, written…
When reading a public page for the first time, consider these 20 test cases to evaluate its functionality and performance:
Functional (FN-01): Verify the URL responds over HTTPS.
Content (CT-01): Check for a present and concise meta description.
Links (LK-01): Identify same-host links discovered from the start page.
Forms (FM-01): Confirm visible fields have proper labels.
Accessibility (A11Y-01): Ensure images have text alternatives.
Security (SEC-01): Ensure HTTPS is the only access method.
Privacy (PR-01): Verify a privacy notice is linked from the page.
SEO (SEO-01): Ensure title, description, canonical, and social tags are consistent.
Performance (PF-01): Confirm the HTML document arrives within a stated budget.
Load (LD-01): Check if a baseline document fetch can be repeated.
Mobile (MB-01): Verify the layout remains intact on a phone screen.
Internationalization (I18N-01): Ensure the language attribute matches the displayed text.
Resilience (RS-01): Confirm a missing path returns a deliberate "not-found" page.
Compatibility (CMP-01): Ensure the page still makes sense when scripts are disabled.
Media (MED-01): Check if video captions or transcripts are available.
Analytics (AN-01): Ensure analytics tags wait for a recorded choice when consent is requested.
Commerce (CM-01): Verify a catalog or payment marker is present without processing an order.
Visual (VIS-01): Confirm images reserve their box before painting.
Platform (PLAT-01): Ensure the public Salesforce path is accessible without an org login.
API (API-01): List a public API description without invoking it.
How to use the list: Begin by examining the public response, including status, headers, and the HTML rendered before any scripts execute. Then, follow any visible same-host links, a few levels deep, noting what each returns. Select the test cases relevant to your situation and assign the appropriate testing tool (Playwright, Cypress, Robot, Selenium, WebdriverIO, Appium, JMeter, Gatling, axe-core, Lighthouse, k6), preparing the case for code implementation.
Treat security headers as indicators, not definitive proof of security. A missing header should prompt questions for the owner, not an indication of a breach. Remember, this list is not a certification nor a penetration test. Reading a public page does not involve logging in, submitting forms, or generating real-world traffic, so further testing plans are required for protected areas or high-traffic scenarios.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
